Microsoft Edge fixes 0-day vulnerability: confirms all Chromium-based browsers vulner

[harlan4096]

Microsoft released a security update for its Edge web browser that address several security issues, including one that is exploited in the wild.

Google released security updates for its Chrome web browser on March 26, 2024. The official release announcement on the Chrome Releases Blog did not reveal that Google was aware that one of the issues was exploited in the wild.

The critical security issue CVE-2024-2883 -- Use after free in ANGLE -- was fixed in Chrome Stable and Chrome Extended Stable on March 26, 2024.

Microsoft pulled an earlier release of Microsoft Edge 123. The company has now released 123.0.2420.65, which addresses eight unique security issues in the browser.

One of them is CVE-2024-2883, which affects all Chromium-based browsers. The official CVE page on Microsoft's website reveals that the issue is already attacked in the wild.

Microsoft writes: "Google is aware that an exploit for CVE-2024-2883 exists in the wild."

The Microsoft Edge release notes page confirms this as well: "This update to Stable channel contains a fix for CVE-2024-2883, which has been reported by the Chromium team as having an exploit in the wild."

This confirms that all Chromium-based browsers, including Google Chrome, are affected by the issue. ANGLE or the ANGLE Project, stands for Almost Native Graphics Layer Engine.

Google announced ANGLE in 2010 and described its goal in the following way: "The goal of ANGLE is to layer WebGL's subset of the OpenGL ES 2.0 API over DirectX 9.0c API calls. [..] it will enable browsers like Google Chrome to run WebGL content on Windows computers without having to rely on OpenGL drivers."

Update immediately



Chromium-based browser users may want to update the browser immediately, provided that an update is available.

Most may load chrome://settings/help in the browser's address bar to open the about page. The "chrome" protocol is usually redirected to the browser's specific protocol. This is edge:// for Microsoft Edge, or vivaldi:// for Vivaldi.
...

Continue Reading